WONTFIX: No patch for Windows Server 2003 IIS critical bug – Microsoft

Suggested workaround for exploited flaw: Upgrade to a non-EoL operating system

Microsoft will not patch a critical security hole recently found and exploited in IIS 6 on Windows Server 2003 R2 - the operating system it stopped supporting roughly two years ago."